Keep OPNsense RRD resolution with the incident evidence

Bottom line: Keep the graph’s data selection with the incident record. Before comparing two averages, establish whether the same dataset, resolution and time interval produced them, then inspect the values behind the view.

Source fact: what the authority says

The OPNsense System Health guide describes a dynamic view of RRD data under Reporting Health. The primary-dataset control selects an RRD dataset, and the guide says datasets farther left have lower maximum resolution. The resolution control sets the maximum plotted data points and indirectly influences the scale of calculated averages. Zoom selection updates the main graph and tables, while the detailed table can export plotted values as CSV.

What the source does not establish

The graph controls do not identify the cause of an incident or establish that the chosen series represents an application’s experience. DSE uses this article to preserve the interpretation of a selected view. Collection gaps, metric definitions and independent service observations need their own assessment.

Applicability questions

• Which category and graph address the incident question?
• What RRD dataset, resolution and selected interval produced the image or average?
• Are the visible labels and units the intended ones, including any hidden series?
• Can another operator reproduce the view and retrieve its detailed values?

DSE recommendation: controlled next steps

The following steps are DSE recommendations based on the cited source.

DSE recommends starting an incident comparison with a short graph record: device, metric, units, primary dataset, resolution, selected labels and interval. Preserve the view before adjusting it. Put the complaint or operational event on the same timeline, but leave the cause unresolved until the observations justify a narrower conclusion.

Use a proposed exercise with one quiet interval and one known authorized workload interval. Compare the same interval at two reviewed display resolutions and retain the settings beside each result. Ask the reviewer to explain any difference in the plotted average using the selected view and underlying values, rather than declaring one screenshot to be the correct account without that context.

Export the detailed values for the final incident interval where useful. Keep the export and screenshot together under an evidence identifier and document any manual calculation used in the report. If a needed historical view is unavailable, record that limitation directly. Avoid filling the gap with an unlabeled interpolation or substituting a different metric simply because it produces a complete-looking chart.

Have the report identify the selected units and plotted series next to the exported values. Preserve a version of the view before hiding any series for readability. Record the reason for a display change without treating that edit as new measurement evidence.

Verification and evidence

Proposed verification: have a second operator recreate the chosen graph from the recorded controls and time interval. Compare the displayed table with the retained CSV and independently check a small selected group of values. Record what was actually available at that resolution, including missing or unexplained observations.

Repeat the comparison for the proposed workload interval without changing the interpretation rules midstream. Preserve the final evidence record with timestamps and the incident question it answers. Keep any additional application or packet measurements separately labeled, then explain how they relate. A reviewer should be able to distinguish a display-setting difference from a measured change in the selected series.

Official references

• OPNsense — System Health & Round Robin Data — official product documentation; confirm the installed release and configuration.

Source review completed October 28, 2026. Recheck the official documentation and deployment-specific applicability before a production change.